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DISCLAIMER 


This report was prepared as an account of work sponsored by the 
United SUtes Government. Neither the United States nur the United 
States Department of Eniargy, nor any of their employeest nor any of 
their contractors, subcontractors, or their employees make any warranty, 
expressed or implied, or assumes any legal liability or responsibility 
for the accuracy, completeness or usefulness of any information, 
apparatus, product or process disclosed, or represents that its use 
would not infringe privately owned rights. 
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INTRODUCTION 
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The concept of product liability Implies that a manufacturer Is 
responsible to the consumer for products that are not reasonably safe. 
Recently, consumers have become more and more aware that manufacturers 
could be liable for harm Incurred by a consumer while using their 
products.^ Evidence of this awareness can be seen by the Increase In 
product liability suits and sizes of awards In recent years. Clearly 
this presents a problem for the manufacturer. Not only must the 
product be reliable and safe for Its Intended purpose, but it must 
also be safe for foreseeable misuse. 

This preliminary report explores product safety and product 
liability considerations for photovoltaic module/array devices. The 
purpose of this study Is twofold— first to give an overview of legal 
Issues as they apply to design, manufacture and use; second, to 
suggest a methodology to be used during design of a photovoltaic 
module/array to minimize or eliminate perceived hazards. This study 
does not attempt to answer any of these questions In detail, but only 
to pose them so as to stimulate consideration of this area. The 
questions raised In this study can only be answered through future 
efforts In concert with the manufacturers. 


11916 Macpherson vs. Buick Motor, Inc. The courts rules that there no 
longer had to be a direct contractual relationship between buyer 
and manufacturer In order for the buyer to recover from harm 
Incurred using a defective product. 

1945 Escola vs. Coca Cola. This decision extended the legal basis of 
recovery to include strict liability in cases involving con- 
struction defects. 

1963 Greenman vs. Yuba Power Products, Inc. The court extended strict 
liability to include design defect cases. 
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APPROACH 


In order to supplement the basic study, certain additional 
activities were pursued. First, a general review of photovoltaic 
literature was made using computerized literature searches. Data 
bases included D.O.E. energy file, NTIS file, Compendex file, 

Conference Paper Index and others* A literature search was also 
made of relevant legal material as it applies to design. 

Examination was made of ftur block HI photovoltaic panels. The 
panels included the shingle type as will as panel type collector. 

Plant trips were made to a number of photovoltaic manufacturers. 
These trips not only included plant tours of manufacturing, testing 
and shipping facilities but also included discussion on design and 
safety aspects of photovoltaic modules. Manufacturers visited included 
Solar Power Corporation, Solarex Corporation, and General Electric 
Company. 
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ELEMENTS OF SAFETY DESIGN REVIEW PROCEDURE 


Fundamental to the concept of weaving safety considerations Into 
the design of a product Is to recognize that there are three elements 
which Interact to create hazards with a consequent risk of Injury: 
the product, the person and the environment within which they function. 
It Is thus essential to outline a structured method which permits the 
designer to address these elements In a rational way. 

i'. 

The steps listed below are an outline of a safety design review 
procedure.* 

1. Delineate the scope of product uses. 

2. Identify the environments within which the product will be 
used . 

3. Describe the user population. 

4. Postulate all possible hazards including estimates of 
probability of occurrence and seriousness of resulting harm. 

5. Delineate alternative design features or production techniques 
including warnings and instructions, that can be expected to 
effectively mitigate or eliminate the hazards. 

)'i 

//' 

6. Evaluate such alternatives relative to the expected per- 
formance standards of the product, including the following: 

a) other hazards that may be introduced by the 
alternatives 

b) their effect on the subsequent usefulness of the 
product 

c) their effect on the ultimate cost of the product 

d) a comparison to similar products 

7. Decide which features to include in the final design. 

The safety design procedure listed above should begin after the 
initial design has been formulated. The process begins by identifying 
the actual scope of the product uses, where the product can be expected 
to be used, and who will be using it. It is critical at this stage 
that foreseeable misuses be thoroughly explored together with the 


*See, Products /l iability and the Reasonably Safe Product , A. S. 
Weinstein, et al., 0pn Wiley & Sons, New Vork, 
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actual limitations and responses of the users. Taken together* they 
set the boundaries of foreseeable use and misuse and foreseeable users. 
Users will Inevitably have a broad range of manual dexterity* strength* 
and levels of understanding and awareness. Once the product use and 
user situations are postulated* the next task Is to Identify the 
hazards that are likely to arise from the Interaction of the product 
use* environment* and user. This Is done* principally* by postulating 
scenarios of occurrences which can lead to hazards. i 

The hazards having been Identified and the probability and 
gravity of the harm that might result having been estimated* the 
question becomes* what changes* In design* can minimize or eliminate 
the risk of Injury? It Is at this point that the problem of design 
changes versus warnings to minimize a given risk must be carefully 
assessed. For each warning or design change some estimate should be 
made of the reduction In both probability and gravity of harm* since 
such reduction can have a significant Impact on the ultimate pro- 
duction cost. Caution must be exercised when suggesting design changes 
because the new design may substitute a new hazard for the one(s) 
being eliminated. 

It Is also possible to take a safe product and make It unsafe by 
creating unrealistic expectations In the mind of the user through ,, 
expressid or Implied warranties. Recent court Interpretations have 
Included advertisements and sales literature In decisions about 
warranties and have concluded that where advertising leads a user to 
false expectations of the product, the manufacturer is liable for 
damages, despite disclaimers in other literatlire. 

As each consideration Is addressed, the effects on product use- 
fulness and cost must obviously be introduced. But product cost is 
not based solely on materials, labor, marketing, overhead, and profit. 
Part of the product cost is that arising from possible Injuries, either 
from the expected fraction of products marketed with production flaws 
or from hazards that the design did not minimize. Whether these 
costs are. In part. Insurance premiums, settlements, judgments, or 
legal fees is not important. They are part of the real cost of the 
product and can significantly affect decisions about which safety 
features to incorporate 1n the final design. Certainly, some of these 
costs (e.g., settlement, judgments) are not factors for a court in 
deciding whether a product Is unreasonably dangerous. A court per- 
forming a risk-utility analysis could not account for a manufacturer's 
settlement practice. Nonetheless, these considerations may weigh 
heavily on the manufacturer when It decides on its design or quality 
control standards. 
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DOCUMENTATION 


Th® methodology described In the preceding section is critical 
for establishing how and why the complex trade-offs were made in order 
to reach the final design, including all of the literature that communi- 
cates to shippers, installers, users as well as to repair and maintenance 
personnel. If all of this effort is not clearly and comprehensively 
documented an important dimension of the process will be lost. The 
manufacturer must be able to assess the efficacy of his decision- 
making process, once field data becomes available. In addition, if 
the manufacturer is alleged to have produced a defective product and 
is sued, it is crucial that he be able to rebut such arguments by 
demonstrating the care used in designing, manufacturing and marketing 
the product, For these reasons it is essential that the manufacturer 
keep a comprehensive record of the process that elucidates all of the 
considerations upon which the design Is based. 

Such documentation can be categorized as: 

1. Hazard and risk data--histor1cal , field, and/or laboratory 
testing, causation analyses.'*' 

2. Design safety formulai.1on»*fault tree, failure modes, hazard 
analyses. 

3. Warnings and Instruction formulat1on--methodology for develop- 
ment and selection.** 

4. Standards— the use of in-house, voluntary, and mandated design 
or performance requirements. 

5. Quality assurance program— mathodol ogy for procedure selection 
and production records. 

6. Product performance— reporting procedures, complaint file, 
follow-;‘p data acquisition and analysis, recall, r?\trofit, 
instruction and warning modification. 

7. Decision making— the "how," "who," and "why" of the process. 

These are the necessary elements for the data base supporting the 
product safety design review. A comprehensive exposition of the basic 
data, coupled with the sensitivity of the decision-making process as 


*Appendix B contains sample of field data. 

** Appendix A contains guidelines for warning development. 
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mustrated through significant documentation, can provide the courts, 
as well as the manufacturer, with the benchmarks needed for Judging a 
product's societal acceptability. 

The hazard and risk data not only should ht acquired from well- 
deslgned laboratory and field tests but also should Include analyses 
of any litigation, user complaints, and field failures. Finally, 
careful scrutiny of both a given manufacturer's liability claims and 
reported appellate decisions for all products of the same type 
throughout the country can uncover problems or use patterns that are 
Important t'^r retrofit considerations as well as for design review. 
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A DESIGN REVIEW BOARD 


The Ifnplement^ttion of a product safety design review requires 
contributions from a variety of disciplines, as well as differing 
viewpoints within a given discipline, Judging the boundaries of human 
behavior and product behavior is too complex to be left in the hands 
of one person or discipline. 

The tasks of a design review board are to elicit and evaluate 
data and to articulate the competing elements for the decision-making 
process, not to redesign the product. Included in the responsibilities 
of the group should be a review of all packaging, labeling, instructions, 
and advertising material, since the explicit representations are an 
essential dimension of the expected performance of a product. 

The group performing the product design review should be composed 
of members from the manufacturer's organization as well as ancillary 


skills from the outside: 

1. 

Engineering or design 

2. 

Producti on 

3. 

Quality assurance 

4. 

Testing 

5. 

Service 

6. 

Marketing 

7. 

Psychology and human factors 

8. 

Legal 


Corporate management should designate a person whose sole 
responsibility is product safety assurance to chair the design review 
board. There must be established a decision-making process and a 
review mechanism for critical decisions which include participation by 
senior corporate members. 

Perhaps the most important tasks to be undertaken by this board, 
collectively, are the identification of the product uses and misuses, 
the nature of the users and the actual product environment. Based upon 
these elements, the board must then construct the hazard scenarios and 
postulate the relative degree of seriousness posed by them. Once 
design modifications, Including warnings and instructions, have been 
postulated, perhaps by the engineering department, the board must then 
assess the proposed changes and make recommendations concerning the 
design formulation that is to be adopted. 
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ILLUSTRATIVE HAZARD ASSESSMENT FOR PHOTOVOLTAIC MODULE/ARW1 


The preceding sections described, in general terms, the nature of 
the design safety review process. In this section, an illustrative 
analysis is presented to demonstrate how this process is to be applied 
to photovoltaic module/arrays. The analysis is not complete, nor is it 
intended to offer solutions to the myriad of problems faced in the 
design process. Its principal goal is to stimulate an awareness of 
the nature of the problems as well as suggested methods for seeking 
solutions. Ultimately, it is only through group effort, rational 
approach and honest assessment that what is initiated here can be 
completed. 

There are six areas to be considered individually for which a 
hazard assessment should be undertaken; 

1. manufacturing and assembly 

2. shipping and handling 

3. installation 

4. operation and maintenance 

5. natural events 

6. other events 

In each of the above areas a scenario of an accident will be 
developed as an example of the type of thought process involved. This 
will be followed by a table suggesting other scenarios and a ranking 
of probability of harm P and the seriousness of the resulting harm S. 

The probability of harm multiplied by the seriousness of harm 
(P X S) permits a relative ranking of the listed hazards. A numerical 
scale of values from one to ten will be used for both the probability 
and seriousiiess scales. A seriousness of ten represents critical 
injury or death, while a probability of ten would indicate that the 
hazard will occur every time a person comes in contact with or uses 
the product. 

Following this ranking, suggested recommendations are listed 
which are intended to eliminate or reduce the probability of harm and 
the resulting injury. 

It should be noted that the numerical values listed for the 
probability of harm (P) and the seriousness (S) are, for the most part, 
subjective assessments since little, if any, data are available. The 
numbers are not to be viewed as absolute in any sense, but are used to 
assess the relative rankings of hazard as a guide to the design formu- 
lation. It is one of the functions of the design review board to 
develop these rankings, collectively, based upon whatever data and 
perceptions that can be brought to bear on the problem. Much of the 
time, however, the hazard index will be based upon subjective analysis, 
rather than objective data. The integrity of the process thus rests on 
a thoughtful, careful and complete analysis. 
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MANUFACTURING AND ASSEMBLY 


As the terrestrial photovoltaics market begins to grow, production 
techniques for automated cell fabrication and assembly will begin to 
appear. Until the large volume terrestrial photovoltaics module market 
develops, many companies will be using hand assembly lines. Evaluation 
of worker safety in a manufacturing environment is a well known and 
documented subject. Many insurance companies have a review program 
for their clients. The Occupational Health and Safety Administration 
has regulations and guidelines on worker safety. One area that needs 
further investigation |s the effects of exposure to silicon either 
directly or indirectly. The major source of silicon exposure is in 
the cutting of silicon to make cells which is currently controlled by 
exhaust loads. Exposure to solvents from encapsulant materials may 
also be a problem. Although not a hazard in the area of manufacture 
and assembly, problems arising from quality assurance can emerge later 
in the operation of array system. For example, poorly soldered?* 
connections can lead to hot spots which could lead to system degredation 
and/or a possible fire. 


Endemic Hazard 

Probability 

P 

Seriousness 

S 

P X S 

1) Exposure to Toxic 
Materials 

8 

3 

24 


Recommendations 

1. The general hazards associated with the workplace are to be 
addressed using OSHA regulations. 

2. Obtain data on toxicity problems associated with silicon and 
solvents and utilize whatever assistance the National Institute 
for Occupational Safety and Health (NIOSH) and Occupstional 
Safety and Health Administration (OSHA) can give in instituting 
procedures to minimize or eliminate potential hazards in these 
areas . 
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SHIPPING AND HANDLING 


Shipping and handling represent an area In which the manu- 
facturer must take precaution to decrease hazards related to his 
product. Modules can range In size from 48“ x 48“ to 32“ x 96“ and 
can weigh anywhere from 70 to 240 pounds, depending on the material 
and size, It Is obvious that panels will often travel great 
distances by several means of transportation and be handled several 
times In their transit. Thus a possible accident Is the dropping of 
the photovoltaic panel container. This dropping could result in a 
minor Injury to the person carrying the container, If the container 
Is then opened and If the glass cover plate Is broken or shattered, 
Injury could result from the broken glass. If the container 1$ 
opened and exposed to light, when examining the module for damage, a 
person could be startled and suffer Injury by falling or In other 
foreseeable ways, If the terminals are shorted and a minor, non-lethal 
shock occurs. 

Since panels can be and are sold individually, off-the-shelf, 
an unskilled user would not necessarily be aware of the electrical 
hazard which would result from daisy-chaining. Alternatively, series- 
wired panels capable of producing up to 6QQ volts each, could pose a 
serious hazard individually or Inadvertently mlswlred In an array, 

The high probability of such events sviggests that each and every panel 
should contain an appropriate, permanent warningi 


Probability* Probability of 


Scenario 

of Harm 

Seriousness 

P X S 

1) electrical shock 
from module 
( series wired) 

7 

6 

42 

2) electrical shock 
from sub-array 
(pre-wired) 

6 

8 

48 

3) injury due to 
broken glass 

5 

B 

25 

4) localized burns from 
electrical shock 

7 

7 

49 

5) reverse bias leading 
to fire 

1 

2 

2 

6) Injuries resulting 
from dropping of 
containers 

3 

5 

15 
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7) other Injuries from 

minor shock 2 5 10 

♦These are the estimated probabilities of injury occurring once 
an event, such as dropping a container, has occurred. No estimate 
is given here as to the probability of the event occurring in the 
first place. The event probability must be estimated in order to 
rank all hazards from all sources. 


From these hypotheses and their relative ranking, a sense of the 
magnitude of the problems is generated, If it is concluded that these 
problems warrant attention* then consideration as to possible solutions 
is to be developed. For example, glass breakage could be reduced by 
using thicker glass. But this change will increase panel weight, lower 
efficiency, increase cost and can increase the severity of the injuries 
resulting from the dropping of a panel or container. 

Alternatively, each panel could be covered with opaque, adhesive 
paper. This would minimize injuries from glass breakage and keep the 
panel electrically inactive under most foreseeable circumstances until 
it Is deliberately removed. If the glass breakage problem is not con- 
sidered serious, but the electrical hazards are deemed important, then 
a shunt resistor could be installed on eacv^ panel and/or plastic 
guards placed over the output terminals that are difficult to remove 
or require a special tool for removal could be considered. Finally, it 
may be decided that only a warning be applied to each panel and no 
design change is necessary at all. 

If modules are shipped In containers, their design should not be 
overlooked. In establishing a basis for the integrity of such a con- 
tainer, an appropriate drop height and surface should be decided. For 
example, is a design drop height of eight feet more appropriate than 
four feet, if shipping is likely to be by railroad? 

Such decisions and the trade-offs involved must be made consciously 
and documented together with the reasoning supporting the final decisions. 

To sunmarize, the alternatives described above, arising from the 
scenarios, are: 

1. Install a shunt resistor in each panel. 

2. Install plastic guards over the module's electrical output 
terminals. 

3. Use thicker glass panel, 

4. Cover the panel front with non-transparent paper. 

5. Place warnings and/or instructions on each panel. 
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After alternatives have been described, some estimate as to their 
effectiveness should becpostulated. Again, it is a subjective deter- 
mination. However, this will permit assessing whether or not any 
reasonable reduction in hazard levef <;oU;ld be'achieved. Listed below 
is the estimated cfiange in each risk of ^injury, if, for example, all 
of the alternatives in the list were incorporated. 


Probabii; ly 


Scenario of Harm 

1) electrical shock 

from module 1 

2) electrical shock 

from sub-array 1 

3) injury due to 

broken glass 1 

A) localized burns 

from electrical shock 1 

5) reverse bias leading 

to f i re 1 

6) injuries resulting from 

dropping of container 3 

7) other injuries from 

minor shock 1 


Probability of 
Seriousness 


6 

8 

5 

7 

2 

2 

2 


P X S 


6 

8 

5 

,1 

2 

15 

2 


Tables such as the preceding ones would then permit the formu- 
lation of benefit/cost analyses of the suggested alternatives, based in 
part upon the projected reduction in both probability and seriousness 
of harm. The design review group would then be in a position to make 
recommendat;?/ons as to which, if any, design changes will meet all of 
the manufacturer's constraints as a reasonable balance of all 
considerations. 

These analyses, coupled with all of the rationale supporting the 
decisions, become both the focus and the source of the product safety 
review as an integral part of the design, manufacture and marketing 
functions. 
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INSTALLATION 


The risks of Injury In the iristallatlon of arrays are somewhat 
dependent on which type of panel Is used— either the shingle type 
(Figure la and b) or the modLle type. For the module type there are 
four different mounting systems; rack mount, standoff mount, direct 
^(Gunt, and Integral mount (Figure 2). Because the rack mount system 
/yU at ground levul it is easier to install and maintain but at the 
same time has a higher hazard level because of its general accessibility 
in contrast to arrays mounted on the roof of a dwelling. 


Probability Probability of 


Scenario 

of Harm 

Seriousness 

injury during 
unpacking 

3 

5 

electrical shock 
from array during 
installation 

7 

6 

electrical shock 
from cabling 

7 

'/ 8 

localized burns 
from electrical 
shock 

7 

7 

injury to others, 
when job site is 
unattended 

8 

8 


P X S 


15 


42 

56 


49 


64 


Some of the possible considerations which could eliminate or minimize 
the risks of injury; 

1, Every installation to have documentation to cover 

a) unpacking of modules 

b) site preparation and module storage 

c) safe installation practices 

d) procedures when job site is left unattended 

e) start up, check out, shut down procedures* 


*A sample of this type of documentation is given in Appendix C. 
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2. Cabling and connectors be protected against shock by guarded 
plugs, requiring special tools for removal. ^ 

}y 

This listing is not intended to bo complete, but serves to point 
out that 'instellation can create risks of injury to two distinct 
classes of persons: the installer and the curious bystander, adults 
as well as children, attracted by the novelty of the installation, The 
installer must be given adequate and easily understood instructions for 
the problems of installation. But the risks that can arise when the 
job site is left unattended each day and over weekends especially when 
the system is only partially completed presents hazards that may equal 
or exceed thosf, to which the installer is exposed. In the current 
legal climate, the manufacturer is expected to and is held to foreseeing 
such highly likely events as well as anticipating inadequate job-site 
practices by installers. 






















Figure 2 


OPERATION AND MAINTENANCE 


It is in the area of residential operation and maintenance that 
many accidents will arise from unskilled persons interacting with the 
photovoltaic system. The number of times that the following events 
will occur will largely depend on the type of installation and its 
geographical location. The activities that will precipitate the 
events are general maintenance, panel cleaning, panel replacement, 
wiring repair, and gasket repair. 


Scenario 

Probability 
of Harm 

Probability of 
Seriousness 

P X S 

1) walks on array 
breaks glass 

3 

5 

15 

2) slides off array 
and falls 

6 

7 

42 

3) electrically shocked 
from array 

4 

8 

32 


Some of the possible considerations that could eliminate or minimize 
the risks of injury: 

1. Documentation in the form of a detailed step-by-step outline 
procedure be supplied on all aspects of the photovoltaic 
array system. 

2. An access system such as the one depicted in Figure 3. 

3. A control panel to read I-V curves for each string. 

4. Need for special tools, that are unavailable to a user, in 
order to undertake electrical repairs. 

Apart from the considerations listed above, 5 broader view of the 
problem could consider (a) including a service contract in the price 
of an installation, with repairs and maintenance to be performed only 
by authorized persons; (b) limiting or controlling sales of panels only 
to such authorized maintenance and repair groups, making them inaccessible 
to unskilled persons. 

It is evident that the problems envisioned here begin with the 
unskilled home-owner using an aluminum U^dder to climt\to the roof in 
order to discover the source of a problem. It is this foreseeable 
eventuality, with a high probability of risk, that a mamifacturer 
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should consider In the entire spectrum of uses of his product. It Is 
clear, today, that a manufacturer of panels will hot be able to defend 
liability simply by stating that he was not responsible for the entire 
system. If In fact, he holds himself knowledgeable for any system 
design. 


i I 

I * 
i 







NATURAL EVENTS 


There are many scenarios that can be proscribed around what are 
termed “natural" events. Only a few are postulated here In order to 
Illustrate the nature of the concerns that should be addressed. 


Fire 

An array In a residential or commercial setting could be exposed 
to fire caused by conditions unrelated to the panels. Are there any 
special problems that can arise when an array Is exposed either to 
direct fire or to Intense heat and then sprayed with water? Have 
any tests been conducted to discover the effect of such exposure? 

When a fire occurs In daylight, what strategies are appropriate for 
Informing fire fighters and others of a concurrent danger of electrical 
shock when In close proximity to the array? 


Snow 

When snow accumulates on a roof array and sufficient sunlight 
penetrates to warm up the panel by Its operation, a condition exists 
for the entire snow load to slide off. If the probability of this 
event is significantly greater than that for existing roofing materials, 
should some provision be Incorporated In the system design to minimize 
the potential hazards to passersby or property In the vicinity? 


Lightning . Hail . Sandstorms . Corrosive Atmosphere 

Each of these events and others could present concerns In the 
areas of use, performance and/or risk of Injury. To what extent have 
these areas been addressed, tested for and deslr^'n decisions articulated? 
The panels, the array, the structure and the wiring, viewed as a system, 
should be examined in the light of the effects of such natural events 
on each of the elements and then on the entire system. 

It is clear that before any performance or design standards can 
be formulated, all likely events should be addressed, whatever data is 
available should be collected and analyzed and tests should be devised 
and conducted. Following this, reasonable standards can be postulated 
and developed to achieve a reasonable balance among safety, performance, 
useful life, repair and cost. 




.>u 
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OTHER EVENTS 


Attractive Nuisance 

Apart from, and in addition to, the hazards described earlier for 
each of the principal areas from manufacturing to operation and main- 
tenance, there exists the potential problems that could arise from the 
unfamlllarlty and hence attractiveness of an Installation. The 
youngsters who view the array as a target for guns or other weapons 
and who may be Injured as a result are a potential for liability, in 
order to discover just what this array does, the curious will climb 
fences and roofs to satisfy that desire. Can additional precautions 
be taken In design to account for the Inevitability of such eve?.i:s, 
recognizing that warnings alone are unlikely to suffice? Whether or 
not any design alterations can be or are formulated to account for 
such events, the decisions must ultimately be based upon careful, 
documented assessment. 


Auxiliary Electrical Systems 

A. Storage Devices 

In all probability, a large number of residential photovoltaic 
systems will utilize batteries for storing energy. While the main- 
tenance and safety of DC battery storage systems is well known and 
documented, such Information and appropriate precautions must be part 
of the concern of the module manufacturer who prescribes, gives con- 
sultation on or designs complete systems. The following areas should 
be addressed for a battery storage system; Electrical protection, 
chemical hazards, fire hazards and concerns for control, monitoring 
and ventilation. 


B. Utility Backup 

Another proposed auxiliary system is that of interconnection with 
a public utility. The obvious concerns arise from 

(a) the need for an automatic disconnect between the photovoltaic 
system and the utility's lines, if the utility suffers a 
complete loss of power. 

(b) The problem faced by a utility if a significant feed by a 
large number of photovoltaic arrays is suddenly lost because 
of a natural event or other cause. 
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In the former event, if there Is not an automatic disconnect, a 
lineman may suffer, injury if the array is feeding into what is believed 
to be a dead line. In the second event, the utility may not be able 
to pick up the load caused by a loss of the photovoltaic source rapidly 
enough to avoid either a blackout or a rapid drop in voltage. If 
significant damage occurs, the»'e will inevitably arise the question of 
responsibility and hence liability, 

These v,reas, too, should be given consideration, not only by 
module manufacturers who may have to share at least some of the 
responsibility, but the other viable enci titles including battery 
manufacturers and the public utilities. 
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FMEA/FTA* 


The FMEA is a technique for systematically identifying, analyzing 
and documenting ttie possible failure modes within a design and the 
effects of such failures on system performance and personnel safety. 

The FMEA is a bottom- to-top analysis which begins at the bottom, the 
component level* and works upward to the end product or system level 
where the effect Of the failure on system performance or personnel 
safety is determined. 

The FTA is similar to the FMEA in that it too is a technique foi* 
systematically identifying, analyzing and documenting potential safrty 
and reliability problems. The FTA differs from the FMEA in its method 
of documentation and in the fact that it is a top-to-bottom analysis. 

It begins with an assumed undesirable event at the top or system level 
and identifies the events at subsequent lower levels in the system 
that can cause the undesirable top event. 

The purpose of both the FMEA and FTA is to identify areas in the 
design or hardware where improvements are required to ensure the system 
will be reliable and safe for its intended use and reasonably fore- 
seeable misuse. The FMEA/FTA can serve to increase the efficiency and 
productivity of design reviews by focusing design review emphasis on 
weak areas in the design; it can also serv^t as a source of material 
for use in preparing reliability and quality assurance test programs, 
and in preparing care and use books or repair and maintenance manuals, 



Who Conducts the FMEA/FTAf 

Generally, the FMEA or FTA can be performed more quickly by the 
responsible design engineer because he is most familiar with his design. 
Having a reliability engineer perform the analysis allows a fresh 
objective analysis of the design. If the analysis is conducted by the 
design engineer, it should be checked by the reliability engineer, and 
vice versa. Together they go over the possible failure modes, possible 
causes, how failures would be evidenced or detected, the consequences 
of failures both on the performance and safety of the product. 


When ^ ^ FMEA/FTA ? 

The FMEA/FTA should become an integral part of the normal product 
design process. 

The primary purpose of the FMEA/FTA is, as stated earlier, to 
identify areas in the design or hardware where improvements should be 

*Much of this information was extracted from the Westinghouse Electric 
Corporation booklet entitled: A Guideline for the FMEA/ FTA. FMEA: Failure 

Modes and Effects Analysis; FTA: Fault Tree Analysis. 
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inade to ensure the system will be reliable and safe for Its Intended 
use’ and reasonably foreseeable misuse* Positive action must be taken 
to correct the deficiencies highlighted by the FMEA or FTA before the 
job can be considered completed. Design changes can be made most 
effectively during the design stage. Making the necessary changes 
after the product is in production is more costly. No new product 
design or major redesign should be released for production without an 
FMEA or FTA having been conducted and the follow up actions accomplished 

Use the FMEA when primary emphasis is to be placed on assuring 
that each component in the design will be examined for possible failure 
modes and the effect on the overall design. 

Use the FTA when primary emphasis is to be placed on analyzing 
specific undesirable top events for identifying cadses and ti^eir 
probabilities of occurrence. 
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FMEA 


FMEA Procedure 

The FMEA procedure described 1n this guideline is a basic 
procedure. There Is no one right way to perforin an FMEA or one right 
forinat to use. The Important thing Is that a form such as the one 
showTi In Figure 4 be used to guide tho analysis through a systematic 
process and document the results. 

The FMEA, as described herein. Is sometimes called a failure 
mode effects and criticality analysis (FME & CA) because the criti- 
cality of each failure mode Is analyzed in this procedure. 

STEP 1— Co^eat the. Data to UAzd.m the AnaZtjits 

First, collect the Information for conducting the FMEA Including 
drawings, schematics, layouts, parts lists, bill of materials. Infor- 
mation on the operating environment, and any other descriptive infor- 
mation on system operation which may be available. Other useful 
documents might be the product design specification and other 
specifications. Industry or association standards, and perhaps 
particulars from the contractual requirements. If the system is in 
the early stages of its design and development, the information avail- 
able for FMEA may be limited, and the depth of analysis will be limited. 
However, if the design Is completed or a prototype hardware model 
exists, the analysis will result in a thorough examination of the 
system. 

STEP 2— PAcpa/ic a Fo/un tjo/i the. 

Figure 4 describes a sample form which can be Used for the FMEA. 
There is no one correct form to use. Prepare a form which best suits 
the person conducting the analysis and the design or hardware being 
analyzed. 

STEP 3— ScqumtcaCfi/ tUt each )MAt to be analyzed by jxuit numbeA and 
by name. 

STEP A--BAle^ly d&icAlbe the. iunctConU] each paA.t .in the Mj^tem 

STEP 5-- List the po66lble ^cUlxtAe mode.6 .in which each pant ca>t ^all 

Frequently there are two or more failure modes for a part, each 
of which could cause different effects on the system performance or 
personnel safety. 
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STEP 6-~U6t the e^^ect each iaUme mode mwtd hax/e on Mjitm 
peAi^oAnance 

For each failure mode identified for a particular part, list the 
effect which that failure could have on the system performance. It 
is quite useful to describe the effect on system performance as it 
would be seen through the eyes of the user. For example, it would be 
better to explain "Dirt on panel surface" rather than "reduction of 
system output." 

STEP 7— U&t the c/UtlcaUtij each ialtoKe mode and the ensuing 
Aesutt on system peA^oAmance oa peASonnet safety 

The criticality analysis is done by establishing a ranking of 
the seriousness and implications of the failure. For example, a 
failure might be Critical, Major, Minor or Insignificant. The 
Critical failure is one which causes or can cause harm to personnel. 

It is a safety hazard. The Major fault is one which causes serious 
effect on operation and requires immediate attention. A Minor fault 
is one which does not cause immediate concern but will require 
attention in the near future. A failure which is Insignificant is 
one which can be tolerated because 1t has little or no effect on 
operation. One popular method of using this measure is as follows: 

C - Critical: There ts a safety hazard. 

MA - Major: System performance is out of control; system is in 
need of immediate repair; service is required inmediately. 

MN - Minor: System performance is degraded but operation can 
continue; repair or correction is needed at earliest 
opportunity. 

I - Insignificant: Failure has no immediate effect on system 
performance. 

STEP 8—Ust .the measuAe pAobabttUty o^ the ^cUZitAe mode occuAAiMg 

E|ter the measure of probability of the failure mode occurring. 
This ei^itry may be very subjective and relate closely to the experience 
of thO' analyst, or it may be quantatively calculated from actual test 
data or field use or from reference to an established part failure 
rate handbook. Another useful technique is to rank the relative 
probability of a part failure to the other possible failure modes in 
that system. For example, one method of establishing relative 
probability of failure is: 

H - High 

Relative degrees of probability M - Moderate 

of failure occurring. L - Low 

U - Unlikely 
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STEP 9— Rev-tew anaZyili, d&tcAnum wheU co/t/ieettue action U 

dictated and ioUta/o up to izz that appfLOpfUate. action X6 
taken 

This is the most important step in the FMEA. The FMEA points the 
my to product improvement. The completed FMEA should be reviewed by 
the design review board to determini what follow up actions are required. 
Unless positive actions are taken to correct the deficiencies identi- 
fied by the analysis, the task is only partially completed. The action 
items which are generated by the FMEA should be documented as shown by 
the Action/Responsibility column in Figure 4. Another very effective 
way to implement the follow up action is to use a separate "Action 
Items" sheet. The "Action Items" sheet should list each required 
action item as identified by the FMEA, the person responsible for the 
action, and a date for completing the action item. The design review 
board should review the findings and recommendations of the FMEA and 
the Action Items list with the design engineer or reliability engjneer 
making the analysis and ensure that corrective action is taken. 
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FAILURE MODE AND EFFECTS ANALYSIS 






To Illustrate the procedure, first, an exati^Jle of the FMEA Is 
presented using a codmon appliance, the steam Iron. FolloMing the 
next section on the fault tree analysis, both of these methods are 
Illustrated for photovoltaic panel. 


An Example of FMEA 

In Figures 5 and 6, the steam Iron example Is shown. In the 
case of much larger systems or equipment, the larger system or equip- 
ment can, and often times, must be divided Into smaller sub-systems 
for the purposes of analysis. 

The first requirement Is the descriptive Information. Shown In 
figure 5 Is the Parts List. Additional Information for an FMEA would 
be an electrical schematic and assembly drawings. 

A portion of the Failure Mode and Effects Analysis for the steam 
iron is shown in Figure 6. 


PARTS LIST 


ITEM: Sttam lron_ 
MODEL: HSSF44-A. 
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P/N 

Part 

1 

8030 

Plug ...... 

2 

270031 

Cord ...... 

3 

0042 

Handia . . . . 

4 

12877 

Uppar Covar . 

18 

25303 

Oimatal Strip 

10 

74C03 

RIvtt 

20 

80872 

Baia Plata . . 

21 

63023 

Pranura Plug 
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FTA Procedure 

There are two significant differences between FTA and the FMEA. 
The first is the method of documentation. The FTA uses a set of 
standard logic symbols to represent events and relationships in the 
hardware. The FMEA, as shown, uses a part-by-part tabular form 
to identify failure modes. The second difference is the starting 
point of the analysis. The FTA begins at the top of the system with 
a statement of an undesired event in the system. The FMEA begins at 
the bottom, the component level, and works upward to the system level 
where the effect on the system performance is described. 

The FTA begins with a statement of an undesired event. This 
establishes the top of the tree. Next, the events which can lead to 
the top event are identified. The events which can cause the next 
level are identified. A tree of events is thus established until the 
undesired events and failures are traced to the lowest identifiable 
level which most often leads to the component level, 

A set of logic systems. Figure 7, is used to develop the fault 
tree. They are standard symbols which should be used when performing 
fault tree analysis. 

STEP 1— Coi£ect the, data, to be. used tn the. OAotysts 

Same as in Step 1 in FMEA procedure. 

STEP Z~-Jdtnti^y the. Top Event (A EoLitt, EcuIuAe. on. PeASomiet 
Hazand] 

The top event is the starting point for the analysis and should 
therefore be well defined. It is an event, a malfunction, or failure 
which affects system performance or personnel safety. The top event 
should be definable and' measurable. 

In some cases there may be more than one top event in which case 
each fault tree can be developed individually. For example consider 
the steam iron again. The functions of a steam iron are: 

(1) to provide heat for ironing. 

(2) to provide steam when required. 

(3) and a necessary and inherent requirement to be reasonably 
safe for use. 

Of course the "system" is going to be hot beyond human tolerance when 
it is being used and that is an acceptable feature but the possibility 
of electrical shock hazard must be considered. So, in defining the 
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top events there are three possible events which could be defined as 
top events: 

(1) temperature, absence of or too high 

(2) steam, none or present when not required 

i ' (3) Injury hazard, electrical shocM 

Note that these three top events can be readily defined and measured. 

STEP 3-PcveXop the, FmU U&e. 

The development of a fault tree begins by stating the top 
undesired event such as a safety hazard, a system failure or some 
definable fault. (Use an event rectangle as Indicated In Figure 7.) 

The starting point for the FTA Is thereby established. The analysis 
continues by Identifying the events on the next level down which 
could cause the top event. The analyst must study the events to 
determine If they will occur as an AND function or an OR function to 
cause the top event. (See Figure 8 exan^les.) The fault tree 
development continues In this manner downward from the top event and 
accounts for all of the contributing events which can lead to the top 
event. The development of the tree is concluded when the lowest 
possible level Is reached to which a basic failure event ca.n be 
assigned. The basic failure events are represented by a circle on the 
fault tree. The basic events are generally hardware failures, errors 
of commission, or errors of omission. 

STEP 4“A64^*t Quanti^ted Valuer Pwbabitity to Bach Event on the 
Fautt TA.ee 

The quantification of the basic fault events can come from several 
sources among which are: established source of component failure rates; 
failure rates from actual field use; estimates of rates of occurrences. 
For example, consider a gasoline driven motor-generator set. There are 
established failure rates for the electrical components which make up 
the voltage regulator "subsystem." These failure rates come from 
established sources of component failure rates. As for the motor, 
years of experience in using that type of motor may provide reliable 
failure rates. These failure rates come from actual field use. And 
an estimate may have to be made that one time in every x uses the 
operator will forget to check the gasoline tank and it will be empty. 
This is an estimated rate of occurrence based on the best information 
available. These are the kinds of data which are used to determine the 
probability of the top undesired event occurring. 

STEP 5--R£u.tcw> the analijiti, deteAmne wheAe coAJiective action ti 

dictated and (Jo-tEow-ap to iee that appAopAiate action ti taken 

As in the FMEA, this is the most important step in the FTA. The 
completed FTA should be reviewed by the design review board to determine 




what follow-up actions are required. Unless positive actions are taken 
to correct the deficiencies identified by the analysis, the task is 
only partially completed. The action items which are generated by the 
FTA should be documented on an "Action Items" sheet. The "Action Items" 
sheet is a very effective way to implement the follow-up action, It 
should list each required action as identified by the FTA, thq person 
responsible for the action, and a date for completing the actvon. Tfe2 
design review board should review the findings and recommendations of 
the FTA and the Action Items list with the design engineer or reliability 
engineer making the analysis and ensure that corrective action is taken. 


Revisions 

As design changes occur during the production life of the product, 
the FMEA and/or FTA should be revised to be kept current with the latest 
configuration. This becomes an important element in the entire docu- 
mentation package. 
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An Example of FTA 

The steam iron example used to illustrate the FHEA is used 
again here, this time applying the techniques of the FTA. 

The steam iron performs two major functions: (1) provides heat, 

(2) provides steam. Suppose the undesired event was stated as "No 
Steam from Iron." This undesired event implies that there is no heat 
to make steam er no water to make steam. 

The Fault Tree for "No Steam from Iron" would look like the tree 
shown in Figure 9, 

Suppose a Fault Tree which looked just like the "No Steam from 
Iron" example was of a system for which event probabilities were 
available. The analysis could then be quantified as shown in Figure 10. 

The event probabilities are: 


Cl 

.005 

C5 

. .001 

C2 

.0005 

C6 

.001 

C3 

.0005 

C7 

.80 

C4 

.002 

El 

.06 


This type of analysis permits a quantification of the top event 
or any of the lower contributing events. In the example of Figure 10 
it can be seen that the top undesired event, Rl, has a probability of 
occurrence of .058, or about 1 out of every 17 times. Further 
inspection shows that event R2 will occur 1 out of every 12S times and 
R3 will occur 1 out of every 20 times (occurrence probabilities of ,008 
vs. .050). It can be seen that events comprising R3 influence the 
undesired top event Rl more than R2 does. Further Investigation shows 
that event R5 influences R3 more than does R4, and so on. 

An analysis of this type is of value in identifying the areas 
where more effort such as design, test, or inspection would be of 
greatest value. 
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An Example of FMEA/FTA Applied to a Photovoltaic Device 
A. FHEA 

Using the guide given in the earlier discussion an FHEA was con- 
ducted for a Block III General Electric shingle. Several changes were 
made in the FMEA Analysis Form to conform to the special requirements 
of the device: 

1) A column labeled Failure Cause(s) was added to make the 
document more useful by providing additional information, 

2) Under Step 7— The *'C" denoting Critical is replaced by 
one of the following: 

CA * death 

CB « serious injury 

GC * minor injury 

,Data for Steps 1-4 were obtained from the General Electric 
Report, "Design, Fabricati-tm, Test, Qualification and Price 
Analysis of 'Third-Generation' Design Solar Cell Modules." 

The following page is the FMEA chart. The subjective conclusions 
concerning, for example, probability and criticality are illustrative 
of a best judgment result. 


B. FTA, 

The data used in this FTA is the same as that used in the preceding 
FMEA. In this case the top event has been identified as "No Electrical 
Power ." This is not to say that this is the only top evenTT The ’ 
probabilities used in this FTA are only estimates and are included just 
to show the mathematics of Fault Tree Analysis, The example illustrates 
the use of the logic symbols and methodology described earlier. 
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SUMMARY 


This report is an exploratory survey of the areas of concern, the 
generic types of hazards that can arise, the methodologies for analysis 
and the types of alternatives that can be devised to enhance safety and 
reduce liability in the use of photovoltaic energy sources. The report 
is not intended to be complete, but is to serve as a catalyst for 
generating the comprehensive procedures and analysis that should be 
part of the design formulation and manufacture of photovoltaic modules, 
arrays and systems. 

It is safe to say that today's product liability climate will 
persist and can expose the module manufacturer to litigation over 
issues that seem remote from legitimate concerns over materials, pro- 
duction, performance and cost, Nevertheless, it is clear that the 
scenarios postulated in this report are foreseeable and will be thrust 
upon manufacturers as responsibilities for which they will be held 
accountable. It Is simply insufficient for manufacturers to disclaim 
knowledge of errant human behavior, of foreseeable misuse or of well- 
meaning, but hazardous attempts to maintain or repair photovoltaic 
systems. 

» 

Of all the elements within the distributive chain from the manu- 
facturer to the youngster playing on a partially-completed installation, 
it is the manufacturer who is generally held to have the knowledge of and 
should have accounted for the reasonably foreseeable events. 

The appropriate time to interweave concerns for safety, reliability 
and performance is during the development phase of a new technology. 

This is the time for the photovoltaics industry to set up the 
procedures, implement the analyses and testing and generate the 
documentation. 

If such an activity is begun now, the result will be safer and 
better understood products and a commensurate reduction in adverse 
liability. 


■ -k. itk. 
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Appendix A 
WARNINGS 


Warnings can be a means for reducing the risk of injury. However, 
a warning is not a substitute for good design. A warning should only 
be used if there is no other effective design alteration that could 
reasonably reduce the risk of injury* 

The difficulties with warnings arises first from the fact that the 
language must be able to conmunicate with all persons who, potentially, 
can come in contact with the product and thus it is inevitable that 
certain classes of persons will not be benefited. Second, many if 
not most injuries result from inadvertent acts and warnings can have 
little effect on human behavior when attention is focused on a more 
important or distracting event. It is apparent, too, that the 
probability of a warning being read and remembered is generally quite 
low. 


When a warning is to be used, however, it must be based upon the 
following considerations: 

a. A statement of the hazard or danger. 

b. A statement of the injury that can occur. 

c. A statement of the action to be taken to reduce or eliminate 

the risk. 

d. The language must be clear and easily understood by the 
majority of persons likely to come in contact with the 
product. 

e. Symbols, graphics, size and location must be such as to 
reasonably draw the attention of those to whom it is 
addressed, 

f. It must be sufficiently permanent to last for the useful life 
of the product to which it is attached. 

For example, a warning that might be appropriate for each panel 
or module could read: 

DANGER 

DO NOT TOUCH 

THIS IS M EircTRrCA’L DEVICE 
A SHOCK CAN KILL 

Wires, boxes or anything else on the 
bottom may cause a shock* For proper 
handling, READ INSTRUCTIONS FIRST. 
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. w 

Depending on the foreseeable uses of a particular module design, 
the appropriate wording may be different and reference to Instructions 
may be Inapplicable or unnecessary, For an array. It may be 
appropriate to have the critical Instructions permanently affixed to 
the structure for Inmedlate access, since It Is foreseeable that 
Instructions are often misplaced or are Inaccessible when heeded. 

Finally, specialized or technical language must be avoided. For 
example, such words and phrases as: "Modules," "connected In series," 
"terminals," "lethal" convey little meaning to the non- technical or 
unsophisticated person. 
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Appendix 6 


The following data are extracted from the report “Larry Dumas 
Module Durability Experience," dated 9/23/80. 

This is an example of the type of data and collection procedures 
necessary as a foundation for the safety analyses of the type 
suggested in this report. Such procedures and data should be 
standardized for effective use by all manufacturers. 

Data is essential for FMEA/FTA studies, quality assurance 
programs, standards development and for cost/benefit analysis of 
proposed design modifications. 
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Appendix C 


Reprinted below Is part of a report by S. E. Forman and E. E. 
Landsman , Safety Procedures for the 25-j^ Solar Photovoltaic Array at 
Mead. Nebraska. It provides a written out step-by-step proce3ure for 
worlTlng on a photovoltaic array system. This is the type of communi- 
cation that should be developed for all array systems. 


II. Electrical Work on Back Surface of Array 
A, Preparation 


1. Place those sections of the field to be worked on in the 
open-circuit mode via the field control panel in the 
trailer. 

CAUTION; A high voltage exists within module strings. 
Avoid contact with modules. 

2. Ground the array test box to the metal support frame 
being worked on by attaching the clip lead to the frame. 

3. Verify that test box is set at open-eircuit for all 
strings. 

4. Pull all connectors from junction box of frame being 
worked on. 

NOTE; There should be no arcing when disconnecting 
connectors. If arcs occur, notify supervisor 
before proceeding. Cap open junction box 
connectors. 

5. Attach the connectors from each string on the frame to the 
test box via mating connectors that are in place on test 
box. Match string numbers when possible (i.e., unless 
they are not noted on connectors at the frame junction 
box). 

6. Test all strings for leakage-current to ground. 

NOTE; If meter dial registers more than 10 microamps, 
STOP , do not proceed with inspection. 

Notify supervisor. 

Return all ground switches to the OPEN position. 
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7, Measure and record in the log book the open-circuit 
voltage, short-circuit current, and ground currents for 
all strings being worked on. (Log book contains range 
of acceptable values.) 

NOTE; Notify supervisor if discrepancies occur. 

8. Place all strings in shorted condition in the test box. 


B. Connect a ground as close as electrically possible to each 
wire connected to the work site, but not at the work site. 

OBJECTIVE: Guarantee that all wires are grounded even if 
disconnected during the work. 

NOTE: A. Grounding connections may, under some conditions, 
draw an arc. Thus, keep eyes and skin away from 
the point of electrical contact, 

B. When frame grounding, always attach lead to frame 
first, then to the point being grounded, 

C. Measure voltage directly from the work sites to the frame. 
Proceed with planned operation unless dangerous voltages are 
noted (over 50 volts). 

D. Upon completing planned operation, remove ground carefully 
as an arc may be drawn. 

NOTE; Remove lead from grounded point first, then remove 
lead from frame ground. 

E. Open-circuit all strings. 

F. Remove string connectors from test box. 

G. Reconnect string connectors to proper points on frame junction 
box. 

NOTE: 


There should be no arcing. 


52 


BIBLIOGRAPHY 


1. Safety Procedures for the 25-KW SoTir Photovoltaic Array at 
Mead, Nebraska, S. E. Forman, E. E. Landsman, MIT Lincoln Labs, 
April 7, 1978. 

2. Westinghouse document: A Guideline for the FMEA/FTA. MB-3350. 

3. Products Liability and the Reasonably Safe Product: A Guide for 
Management, Design and Marketing, A. S. Weinstein, A. D. Twerski, 
H. R. Piehler and W. A. Donaher, John Wiley and Sons, New York, 
July 1978. 

4. Interim Performance Criteria for Photovoltaic Energy Systems, 
SERI, Golden, Colorado, May 1980. 

5. SAE ARP926A Fault/Failure Analysis Procedure, November 1979, 

6. Operation and Maintenance Cost Data for Residential Photovoltaic 
Modules/Panels, Bant, Hall, Kosar, Rittlemann Associates, 

July 1980, 

7. Final Report, Design, Fabrication, Test, Qualification, and Price 
Analysis of "Third-Generation" Design Solar Cell Modules, General 
Electric, March 1980, 

8. Residential Photovoltaic Module Array Requirement Study, Bent, 
Hall, Kosar, Rittlemann Associates, June 1979. 

9. Energy Storage for Photovoltaic Conversion Final Report— Utility 
Systems, Volume II, Westinghouse Corporation, September 30, 1977. 




